A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
OpenFGA is designed to make it easy for developers to model their application permissions and add and integrate fine-grained authorization into their applications.
The following section aims to help you get started quickly. Please look at our official documentation for in-depth information.
ℹ️ The following sections setup an OpenFGA server using the default configuration values. These are for rapid development and not for a production environment. Data written to an OpenFGA instance using the default configuration with the memory storage engine will not persist after the service is stopped.
For more information on how to configure the OpenFGA server, please take a look at our official documentation on Configuring OpenFGA or our Production Checklist.
OpenFGA is available on Dockerhub, so you can quickly start it using the in-memory datastore by running the following commands:
docker pull openfga/openfga
docker run -p 8080:8080 -p 3000:3000 openfga/openfga run
docker-compose.yaml
provides an example of how to launch OpenFGA using docker compose
.
-
First, either clone this repo or curl the
docker-compose.yaml
file with the following command:curl -LO https://openfga.dev/docker-compose.yaml
-
Then, run the following command:
docker compose up openfga
Download your platform's latest release and extract it. Then run the binary with the command:
./openfga run
There are two recommended options for building OpenFGA from source code:
Make sure you have Go 1.18 or later installed. See the Go downloads page.
You can install from source using Go modules:
-
First, make sure
$GOBIN
is on your shell$PATH
:export PATH=$PATH:$(go env GOBIN)
-
Then use the install command:
go install github.com/openfga/openfga/cmd/openfga
-
Run the server with:
./openfga run
Alternatively you can build OpenFGA by cloning the project from this Github repo, and then building it with the go build
command:
-
Clone the repo to a local directory, and navigate to that directory:
git clone https://github.com/openfga/openfga.git && cd openfga
-
Then use the build command:
go build cmd/openfga/openfga.go
-
Run the server with:
./openfga run
This section assumes that you have cloned the repository.
To run OpenFGA with the Postgres datastore engine first build OpenFGA and start Postgres in a container:
make build
docker compose up -d postgres
Then run the following commands:
./openfga migrate --datastore-engine postgres --datastore-uri 'postgres:https://postgres:password@localhost:5432/postgres?sslmode=disable'
./openfga run --datastore-engine postgres --datastore-uri 'postgres:https://postgres:password@localhost:5432/postgres?sslmode=disable'
You should see using 'postgres' storage engine
in the logs.
When you are done you can stop the Postgres container with:
docker compose down
Now that you have Set up and Installed OpenFGA, you can test your installation by creating an OpenFGA Store.
curl -X POST 'localhost:8080/stores' \
--header 'Content-Type: application/json' \
--data-raw '{
"name": "openfga-demo"
}'
If everything is running correctly, you should get a response with information about the newly created store, for example:
{
"id": "01G3EMTKQRKJ93PFVDA1SJHWD2",
"name": "openfga-demo",
"created_at": "2022-05-19T17:11:12.888680Z",
"updated_at": "2022-05-19T17:11:12.888680Z"
}
The Playground facilitates rapid development by allowing you to visualize and model your application's authorization model(s) and manage relationship tuples with a locally running OpenFGA instance.
To run OpenFGA with the Playground disabled, provide the --playground-enabled=false
flag.
./openfga run --playground-enabled=false
Once OpenFGA is running, by default, the Playground can be accessed at https://localhost:3000/playground.
In the event that a port other than the default port is required, the --playground-port
flag can be set to change it. For example,
./openfga run --playground-enabled --playground-port 3001
Profiling through pprof can be enabled on the OpenFGA server by providing the --profiler-enabled
flag.
./openfga run --profiler-enabled
If you need to serve the profiler on a different address than the default :3001
, you can do so by specifying the --profiler-addr
flag. For example,
./openfga run --profiler-enabled --profiler-addr :3002
Take a look at examples of how to:
- Write an Authorization Model
- Write Relationship Tuples
- Perform Authorization Checks
- Add Authentication to your OpenFGA server
Don't hesitate to browse the official Documentation, API Reference.
The core OpenFGA service has been in use by Auth0 FGA in production since December 2021.
OpenFGA's PostgreSQL Storage Adapter was purposely built for OpenFGA and does not have production usage yet.
The OpenFGA team will do its best to address all production issues with high priority.
See CONTRIBUTING.